Document-Borne AI Worms Self-Propagate Through Copilot for Word
Document-borne AI worms can self-propagate through Copilot for Word
I demonstrate how hidden instructions in a shared document can trick Copilot for Word into altering content and copying the attack into new files. This creates a self-propagating AI worm that spreads through normal document workflows without further attacker involvement. Despite coordinated disclosure and model upgrades, no robust mitigation currently exists, leaving organizations vulnerable to these silent, document-based attacks.
Defenders cannot reduce exposure to a risk they are unaware of, and the propagation mechanism described here affects ordinary document workflows that many organizations already rely on.
- rwmj
> "At the time of publication, no robust mitigation for the broader vulnerability class is available"
Isn't it obvious by now that it's never going to be possible to fix this kind of thing, at least until we stop mixing up instructions with data.
- boothby
This is going to get worse, much worse, before it gets better. People are granting so much access to their agents, it's ridiculous.
Imagine a comment posted to a popular github repo. No code, just instructions to "reproduce a bug." Maybe it steals your credit card or bitcoin wallet. Maybe it does something more nefarious. It then propagates itself to another repo through your github account.
- simonw
> Malicious instructions hidden in an externally shared document could make Copilot alter drafted or edited documents in Word and propagate the attack to new documents.
Oh no.
- averagjoe
I'm a programmer and a web-based AI user, but I don't want AI running on my local machine in any form. I've uninstalled Copilot and disabled AI in all local applications including the browser itself for exactly the reason described in this article. There's no way to protect your data from such an AI confusion attack by design. AI cannot discern your prompts versus text in file. The fact that an AI enabled word processor or email app could follow instructions embedded in a run-of-the-mill document or email is insane. Switching to Linux, BSD or another open source operating system is the only real solution to this problem.
- piker
White text still works!
There are many approaches today. Check out https://tritium.legal/blog/noroboto where we tricked frontier algorithms into reading different Unicode values from those presented by the fonts in the document.
- nticompass
It's VBScript/macro worms all over again!
- officeplant
Look on the positive side, the faster AI causes more harm the faster our bosses might wake up and push anti-AI company policies!
Oh who am I kidding, ya'll asked for this reality. I will take great joy in the suffering from my AI-less soapbox.
- Schlagbohrer
Has anyone pointed out yet that in a world full of AIs, these worms are just memes? Memetic idea propagation, same as what happens with us apes.